Skip to content

chore(deps): update docker build tooling - #939

Open
hoverkraft-bot[bot] wants to merge 1 commit into
mainfrom
renovate/docker-build-tooling
Open

chore(deps): update docker build tooling#939
hoverkraft-bot[bot] wants to merge 1 commit into
mainfrom
renovate/docker-build-tooling

Conversation

@hoverkraft-bot

@hoverkraft-bot hoverkraft-bot Bot commented Oct 30, 2026

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Update Change
docker/buildx patch v0.38.0 → v0.38.1
moby/buildkit patch v0.34.0 → v0.34.1

Release Notes

docker/buildx

v0.38.1

Compare Source

buildx 0.38.1

Welcome to the v0.38.1 release of buildx!

Please try out the release binaries and report any issues at
https://github.com/docker/buildx/issues.

Security

This release has been built with updated Go runtime 1.26.10 to address CVE-2026-111943 by rejecting certificate chains that include eight revoked eMudhra intermediate certificates.
Image pulls and pushes fail TLS certificate verification if a registry's certificate chain relies on one of the affected TLS intermediates.
Affected registries need a replacement certificate chain that does not use these intermediates.

The blocked intermediates are:

  • Domain-validated TLS: EM DV TLS CA - G3B and EM DV TLS CA - G3C
  • Organization-validated TLS: EM OV TLS CA - G3B and EM OV TLS CA - G3C
  • Extended-validation TLS: EM EV TLS CA - G3B and EM EV TLS CA - G3C
  • Code signing: EM OV CS CA - G3B and EM OV CS CA - G3C

The G3B intermediates belong to eMudhra BV, and the G3C intermediates belong to eMudhra Inc.
The keys for these intermediates were compromised.

Read more about the eMudhra Intermediate CA Compromise

There are no functional changes in Buildx itself compared to the previous release.

Previous release can be found at v0.38.0

moby/buildkit

v0.34.1

Compare Source

buildkit 0.34.1

Welcome to the v0.34.1 release of buildkit!

Please try out the release binaries and report any issues at
https://github.com/moby/buildkit/issues.

Security

This release has been built with updated Go runtime 1.26.10 to address CVE-2026-111943 by rejecting certificate chains that include eight revoked eMudhra intermediate certificates.
Image pulls and pushes fail TLS certificate verification if a registry's certificate chain relies on one of the affected TLS intermediates.
Affected registries need a replacement certificate chain that does not use these intermediates.

The blocked intermediates are:

  • Domain-validated TLS: EM DV TLS CA - G3B and EM DV TLS CA - G3C
  • Organization-validated TLS: EM OV TLS CA - G3B and EM OV TLS CA - G3C
  • Extended-validation TLS: EM EV TLS CA - G3B and EM EV TLS CA - G3C
  • Code signing: EM OV CS CA - G3B and EM OV CS CA - G3C

The G3B intermediates belong to eMudhra BV, and the G3C intermediates belong to eMudhra Inc.
The keys for these intermediates were compromised.

Read more about the eMudhra Intermediate CA Compromise

There are no functional changes in BuildKit itself compared to the previous release.

Previous release can be found at v0.34.0

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate CLI.

@github-actions

github-actions Bot commented Oct 30, 2026

Copy link
Copy Markdown
Contributor

Super-linter summary

Language Validation result
BIOME_FORMAT Pass ✅
BIOME_LINT Pass ✅
CHECKOV Pass ✅
GITHUB_ACTIONS_ZIZMOR Pass ✅
GITLEAKS Pass ✅
GIT_MERGE_CONFLICT_MARKERS Pass ✅
JSCPD Pass ✅
PRE_COMMIT Pass ✅
SPELL_CODESPELL Pass ✅
TRIVY Fail ❌
YAML Pass ✅
YAML_PRETTIER Pass ✅

Super-linter detected linting errors

For more information, see the GitHub Actions workflow run

Powered by Super-linter

TRIVY 

Report Summary

┌──────────────────────────────────────────────┬────────────┬─────────────────┬───────────────────┬─────────┐
│                    Target                    │    Type    │ Vulnerabilities │ Misconfigurations │ Secrets │
├──────────────────────────────────────────────┼────────────┼─────────────────┼───────────────────┼─────────┤
│ actions/helm/generate-docs/package-lock.json │    npm     │       11        │         -         │    -    │
├──────────────────────────────────────────────┼────────────┼─────────────────┼───────────────────┼─────────┤
│ actions/helm/release-chart/package-lock.json │    npm     │        0        │         -         │    -    │
├──────────────────────────────────────────────┼────────────┼─────────────────┼───────────────────┼─────────┤
│ tests/charts/package-lock.json               │    npm     │        0        │         -         │    -    │
├──────────────────────────────────────────────┼────────────┼─────────────────┼───────────────────┼─────────┤
│ Dockerfile                                   │ dockerfile │        -        │         0         │    -    │
├──────────────────────────────────────────────┼────────────┼─────────────────┼───────────────────┼─────────┤
│ tests/application/Dockerfile                 │ dockerfile │        -        │         0         │    -    │
└──────────────────────────────────────────────┴────────────┴─────────────────┴───────────────────┴─────────┘
Legend:
- '-': Not scanned
- '0': Clean (no security findings detected)


For OSS Maintainers: VEX Notice
--------------------------------
If you're an OSS maintainer and Trivy has detected vulnerabilities in your project that you believe are not actually exploitable, consider issuing a VEX (Vulnerability Exploitability eXchange) statement.
VEX allows you to communicate the actual status of vulnerabilities in your project, improving security transparency and reducing false positives for your users.
Learn more and start using VEX: https://trivy.dev/docs/v0.69/guide/supply-chain/vex/repo#publishing-vex-documents

To disable this notice, set the TRIVY_DISABLE_VEX_NOTICE environment variable.


actions/helm/generate-docs/package-lock.json (npm)
==================================================
Total: 11 (UNKNOWN: 0, LOW: 3, MEDIUM: 3, HIGH: 5, CRITICAL: 0)

┌──────────────────────────────┬─────────────────────┬──────────┬────────┬───────────────────┬─────────────────────┬──────────────────────────────────────────────────────────────┐
│           Library            │    Vulnerability    │ Severity │ Status │ Installed Version │    Fixed Version    │                            Title                             │
├──────────────────────────────┼─────────────────────┼──────────┼────────┼───────────────────┼─────────────────────┼──────────────────────────────────────────────────────────────┤
│ @modelcontextprotocol/server │ CVE-2026-111768     │ HIGH     │ fixed  │ 2.0.0             │ 2.3.0               │ MCP TypeScript SDK: One HTTP request within the default size │
│                              │                     │          │        │                   │                     │ limit could...                                               │
│                              │                     │          │        │                   │                     │ https://avd.aquasec.com/nvd/cve-2026-111768                  │
│                              ├─────────────────────┤          │        │                   │                     ├──────────────────────────────────────────────────────────────┤
│                              │ CVE-2026-111770     │          │        │                   │                     │ MCP TypeScript server SDK: Shared transport or server        │
│                              │                     │          │        │                   │                     │ instances delivered one...                                   │
│                              │                     │          │        │                   │                     │ https://avd.aquasec.com/nvd/cve-2026-111770                  │
│                              ├─────────────────────┤          │        │                   ├─────────────────────┼──────────────────────────────────────────────────────────────┤
│                              │ GHSA-f897-62hf-6gxq │          │        │                   │ 2.1.0               │ MCP TypeScript SDK: HTTP server transports and handlers did  │
│                              │                     │          │        │                   │                     │ not limit request...                                         │
│                              │                     │          │        │                   │                     │ https://github.com/advisories/GHSA-f897-62hf-6gxq            │
│                              ├─────────────────────┼──────────┤        │                   ├─────────────────────┼──────────────────────────────────────────────────────────────┤
│                              │ CVE-2026-111771     │ MEDIUM   │        │                   │ 2.3.0               │ MCP TypeScript SDK: Server bearer authentication accepted    │
│                              │                     │          │        │                   │                     │ tokens issued for another service...                         │
│                              │                     │          │        │                   │                     │ https://avd.aquasec.com/nvd/cve-2026-111771                  │
├──────────────────────────────┼─────────────────────┤          │        ├───────────────────┼─────────────────────┼──────────────────────────────────────────────────────────────┤
│ fast-uri                     │ CVE-2026-110180     │          │        │ 3.1.8             │ 2.4.8, 3.1.9, 4.2.3 │ fast-uri: fast-uri: Security policy bypass via improper host │
│                              │                     │          │        │                   │                     │ canonicalization                                             │
│                              │                     │          │        │                   │                     │ https://avd.aquasec.com/nvd/cve-2026-110180                  │
│                              ├─────────────────────┤          │        │                   │                     ├──────────────────────────────────────────────────────────────┤
│                              │ CVE-2026-110306     │          │        │                   │                     │ fast-uri: fast-uri: Cross-Site Scripting via improper URI    │
│                              │                     │          │        │                   │                     │ scheme decoding                                              │
│                              │                     │          │        │                   │                     │ https://avd.aquasec.com/nvd/cve-2026-110306                  │
│                              ├─────────────────────┼──────────┤        │                   │                     ├──────────────────────────────────────────────────────────────┤
│                              │ CVE-2026-110095     │ LOW      │        │                   │                     │ fast-uri: fast-uri: Path traversal via improper relative URI │
│                              │                     │          │        │                   │                     │ normalization                                                │
│                              │                     │          │        │                   │                     │ https://avd.aquasec.com/nvd/cve-2026-110095                  │
│                              ├─────────────────────┤          │        │                   │                     ├──────────────────────────────────────────────────────────────┤
│                              │ CVE-2026-110725     │          │        │                   │                     │ fast-uri: fast-uri: Cross-site scripting via unescaped colon │
│                              │                     │          │        │                   │                     │ in relative URI paths                                        │
│                              │                     │          │        │                   │                     │ https://avd.aquasec.com/nvd/cve-2026-110725                  │
├──────────────────────────────┼─────────────────────┼──────────┤        ├───────────────────┼─────────────────────┼──────────────────────────────────────────────────────────────┤
│ markdown-it                  │ CVE-2026-111758     │ HIGH     │        │ 15.0.1            │ 14.3.3, 15.0.3      │ markdown-it: markdown-it: Denial of Service via unclosed     │
│                              │                     │          │        │                   │                     │ link reference definitions                                   │
│                              │                     │          │        │                   │                     │ https://avd.aquasec.com/nvd/cve-2026-111758                  │
│                              ├─────────────────────┤          │        │                   ├─────────────────────┼──────────────────────────────────────────────────────────────┤
│                              │ CVE-2026-111759     │          │        │                   │ 15.0.2, 14.3.2      │ markdown-it: markdown-it: Denial of Service via mismatched   │
│                              │                     │          │        │                   │                     │ quote parsing                                                │
│                              │                     │          │        │                   │                     │ https://avd.aquasec.com/nvd/cve-2026-111759                  │
│                              ├─────────────────────┼──────────┤        │                   ├─────────────────────┼──────────────────────────────────────────────────────────────┤
│                              │ CVE-2026-111766     │ LOW      │        │                   │ 14.3.3, 15.0.3      │ markdown-it: markdown-it: Denial of Service via repeated     │
│                              │                     │          │        │                   │                     │ unterminated inline HTML constructs                          │
│                              │                     │          │        │                   │                     │ https://avd.aquasec.com/nvd/cve-2026-111766                  │
└──────────────────────────────┴─────────────────────┴──────────┴────────┴───────────────────┴─────────────────────┴──────────────────────────────────────────────────────────────┘

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants